Getting Data In

index future date events as today's date in _time

ayush1906
Path Finder

I am getting a future timestamped event, but I want to index it as default time of index. i.e. at the time when it got indexed.

Presently I have changed

MAX_DAYS_HENCE = 0

in my props.conf. But I found out that the event having tomorrow's date are getting index with tomorrow's date instead of today's date.

alt text

Like today its 23 July, I am looking for any events after today to be indexed for time 23 July. But in my case 24 July is taken as a valid date which should not be the case.

Any other workaround would be appreciated.

The source data is JSON response of API which I am indexing via python script and taking PED field as _time

0 Karma
1 Solution

adonio
Ultra Champion
0 Karma

adonio
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...